​

Core Concepts

Golem AI is built around a handful of objects. Understanding how they relate makes everything else click.

​

Apps

An App is the top-level container for one target. It holds the target domain (for web) or store identifier (for mobile), plus:

• Audit history — every engagement run against the target
• Findings — aggregated across all audits
• Discovered assets — subdomains and their screenshots/tech stacks
• Scheduled audits — cron-based recurring runs
• Billing — plan and credit balance (scoped per app)
• Security focus — default emphasis for deep audits

​

Web vs mobile apps

A web app is scoped to a verified domain. A mobile app is scoped to an iOS bundle ID (com.acme.app) or Android package name, verified through the store’s public developer contact plus an attestation you sign.

​

App drafts

Before an app exists, it’s a draft. The flow is always: create draft → prove ownership → finalize. Verification is by meta tag or DNS TXT for web apps, and by store metadata + attestation for mobile apps. A draft that fails verification never becomes an app — Golem never audits an unverified target.

​

Audits

An Audit is a single offensive engagement. You choose a mode and Golem executes accordingly. Every audit produces findings, a security score with a full breakdown, a coverage summary of what was actually tested, a Markdown report, and a PDF you can export from the dashboard.

​

Findings

A Finding is a confirmed vulnerability with evidence. Golem only emits findings on confirmed compromise or exposure — not theoretical issues or unverified scanner output. Each finding includes:

• Severity — Critical, High, Medium, Low, or Info
• Class — exploit, exposure, misconfiguration, or coverage (documented gap)
• Source — agent (found by Golem’s reasoning) or baseline (deterministic scanner)
• Verification status — whether the finding was independently re-verified
• Evidence — raw command output that proves the issue, traced to a real command execution
• CVE enrichment — CVSS score, CISA KEV status, and EPSS where applicable

See Findings & Evidence for the full structure and the validation pipeline behind it.

​

The Golem agent

Golem is the AI red-team operator that runs the deep phase of every audit. It plans its own attack chain, executes real commands in a real sandbox, and iterates: scan → analyze → pivot → exploit. It can only submit findings through a validated tool call — claims without proof are rejected automatically. Read more in The Golem Agent.

​

The darkops sandbox

Every audit runs in a fresh darkops sandbox — a hardened Linux environment pre-loaded with the offensive toolkit (nuclei, subfinder, httpx, katana, ffuf, sqlmap, dalfox, custom probes, and more). The sandbox is isolated, ephemeral, and destroyed when the audit ends. See Toolkit for the full inventory.

​

CVE Intelligence

Beyond audits, Golem maintains a live catalog of every published CVE (NVD), enriched with CISA KEV and FIRST EPSS data, refreshed daily. Browse it globally or scoped to your app’s identity, and see which CVEs are open, fixed, or reopened for each of your apps based on audit-derived exposure tracking. See CVE Intelligence.